Conference PaperPDF Available

Decidability results for ATL with imperfect information and perfect recall

Authors:
Decidability results for ATLwith imperfect information and
perfect recall
Raphaël Berthon
ENS Rennes
Rennes, France
raphael.berthon@ens-rennes.fr
Bastien Maubert
University of Naples Federico II
Naples, Italy
bastien.maubert@gmail.com
Aniello Murano
University of Naples Federico II
Naples, Italy
murano@na.infn.it
ABSTRACT
Alternating-time Temporal Logic (ATL) is a central logic
for multiagent systems. It has been extended in various
ways, notably with imperfect information (ATL
i). Since the
model-checking problem against ATL
ifor agents with per-
fect recall is undecidable, studies have mostly focused either
on agents without memory, or on alternative semantics to
retrieve decidability. In this work, we establish new, strong
decidability results for agents with perfect recall. We first
prove a meta-theorem that allows the transfer of decidability
results for classes of multiplayer games with imperfect infor-
mation, such as games with hierarchical observation, to the
model-checking problem for ATL
i. We also establish that
model checking ATLwith strategy context and imperfect
information for hierarchical instances is decidable.
1. INTRODUCTION
In formal system verification, model checking is a well-
established method to automatically check the correctness
of a system [7, 30, 8]. It consists in modelling the system as
a mathematical structure, expressing its desired behaviour
as a formula from some suitable logic, and checking whether
the model satisfies the formula. In the nineties, interest has
arisen in the verification of multiagent systems (MAS), in
which various entities (the agents) interact and can form
coalitions to attain certain objectives. This led to the devel-
opment of logics that allow reasoning about strategic abili-
ties in MAS [2, 26, 18, 34, 1, 6].
Alternating-time Temporal Logic (ATL), introduced by
Alur, Henzinger, and Kupferman [2], plays a central role in
this line of work. This logic, interpreted on concurrent game
structures, extends CTLwith strategic modalities. These
modalities allow one to reason about the existence of strate-
gies for coalitions of agents to force the system’s behaviour to
satisfy certain temporal properties. ATLhas been extended
in many ways, and among these extensions an important one
is ATLwith strategy context [5, 24]. In ATL, strategies of
all agents are forgotten at each new strategic modality. In
ATLwith strategy context (ATL
sc) instead they are stored
in a strategy context, and are forgotten only when replaced
by a new strategy or when the formula explicitly unbinds
the agent from her strategy. Thanks to this additional ex-
Appears in: Proceedings of the 16th International Confer-
ence on Autonomous Agents and Multiagent Systems (AA-
MAS 2017), S. Das, E. Durfee, K. Larson, M. Winikoff
(eds.), May 8–12, 2017, S˜ao Paulo, Brazil.
Copyright c
2017, International Foundation for Autonomous Agents and
Multiagent Systems (www.ifaamas.org). All rights reserved.
pressive power, ATL
sc can express important game theoretic
concepts such as the existence of Nash Equilibria [24].
In many real-life scenarios, such as poker for instance,
agents do not always know precisely what is the current
state of the system. Instead, they have a partial view, or
observation, of the state. This fundamental feature of MAS
is called imperfect information, and it is known to quickly
bring about undecidability when involved in strategic prob-
lems, especially when agents have perfect recall of the past,
which is a usual and important assumption in games with
imperfect information and epistemic temporal logics [12].
For instance solving multiplayer games with imperfect in-
formation and perfect recall, i.e., deciding the existence of
a distributed winning strategy in such games, is already un-
decidable for reachability objective, as proven by Peterson,
Reif and Azhar [27]. Since such games are easily captured
by ATLwith imperfect information (ATL
i), model checking
ATL
iwith perfect recall is also undecidable [2].
However it is known that restricting attention to cases
where some sort of hierarchy exists on the different agents’
information yields decidability for several problems related
to the existence of strategies. Synthesis of distributed sys-
tems, which implicitly uses perfect recall and is undecid-
able in general [29], is decidable for hierarchical architec-
tures [22]. Actually, for branching-time specifications, dis-
tributed synthesis is decidable exactly on architectures free
from information forks, for which the problem can be re-
duced to the hierarchical case [13]. For richer specifications
from alternating-time logics, being free of information forks
is no longer sufficient, but distributed synthesis is decid-
able precisely on hierarchical architectures [31]. Similarly,
solving multiplayer games with imperfect information and
perfect recall, i.e., checking for the existence of winning dis-
tributed strategies, is decidable for ω-regular winning con-
ditions when there is a hierarchy among players, each one
observing more than those below [28, 22]. Recently, it has
been proven that this assumption can be relaxed while main-
taining decidability: the problem remains decidable if the hi-
erarchy can change along a play, or even if transient phases
without such a hierarchy are allowed [4].
Our contribution. In this work we establish several
decidability results for model checking ATL
iwith perfect
recall, with and without strategy context, all related to no-
tions of hierarchy. Our first result is a theorem that allows
the transfer of decidability results for classes of multiplayer
games with imperfect information, such as those mentioned
above, to the model-checking problem for ATL
i. This theo-
rem essentially states that if solving multiplayer games with
imperfect information, perfect recall and omega-regular ob-
jectives is decidable on some class of concurrent game struc-
tures, then model checking ATL
iwith perfect recall is also
decidable on this class of models (a simple bottom-up algo-
rithm that evaluates innermost strategic modalities in every
state of the model suffices). As a direct consequence we eas-
ily obtain new decidability results for the model checking of
ATL
ion several classes of concurrent game structures.
Our second contribution considers ATLwith imperfect
information and strategy context (ATL
sc,i). Because there
are in general infinitely many possible strategy contexts, the
bottom-up approach used for ATL
icannot be used here.
Instead we build upon the proof presented in [24] that es-
tablishes the decidability of model checking ATL
sc by re-
duction to the model-checking problem for Quantified CTL
(QCTL). The latter extends CTLwith second-order quan-
tification on atomic propositions, and it has been well stud-
ied [33, 20, 21, 14, 23]. QCTL
i, an imperfect-information
extension of QCTL, has recently been introduced, and its
model-checking problem was proven decidable for the class
of hierarchical formulas [3]. In this paper we define a no-
tion of hierarchical instances for the ATL
sc,i model-checking
problem: informally, an ATL
sc,i formula ϕtogether with
a concurrent game structure Gis a hierarchical instance
if outermost strategic modalities in ϕconcern agents who
observe less in G. We adapt the proof from [24] and re-
duce the model-checking problem for ATL
sc,i on hierarchi-
cal instances to the model-checking problem for hierarchical
QCTL
iformulas. We obtain that model checking hierarchi-
cal instances of ATL
sc,i with perfect recall is decidable.
Related work. The model-checking problem for ATL
iis
known to be decidable when agents have no memory [32],
and the case of agents with bounded memory reduces to
that of no memory. Another way to retrieve decidability
is to assume that all agents in a coalition have the same
information, either because their observations of the system
are the same, or because they can communicate and share
their observations [15, 10, 16, 19]. This idea was also used
recently to establish a decidability result for ATL
sc,i [25]
when all agents have the same observation of the game.
The results we establish here thus strictly extend previ-
ously known results on the decidability of model checking
ATL
iand ATL
sc,i with perfect recall and standard seman-
tics, and they hold for vast, natural classes of instances, that
all rely on notions of hierarchy, which seems to be inherent to
all decidable cases of strategic problems for multiple entities
with imperfect information and perfect recall.
Outline. After setting some basic definitions in Section 2,
we present our meta-theorem on the model checking problem
for ATL
iin Section 3. In Section 4 we prove that when
restricted to hierarchical instances, model checking ATL
sc,i
is decidable, and we conclude in Section 5.
2. PRELEMINARIES
Let Σ be an alphabet. A finite (resp. infinite )word over
Σ is an element of Σ(resp. Σω). The empty word is noted
, and Σ+= Σ\ {}. The length of a word is |w|:= 0 if w
is the empty word , if w=w0w1. . . wnis a finite nonempty
word then |w|:= n+ 1, and for an infinite word wwe let
|w|:= ω. Given a word wand 0 i, j ≤ |w| − 1, we let wi
be the letter at position iin wand w[i, j ] be the subword of
wthat starts at position iand ends at position j. For nN
we let [n] := {1,...,n}. Finally, for the rest of the paper, let
us fix a countably infinite set of atomic propositions AP and
let AP ⊂ AP be some finite subset of atomic propositions.
2.1 Kripke structures
AKripke structure over AP is a tuple S= (S, R, `) where
Sis a set of states,RS×Sis a left-total1transition
relation and `:S2AP is a label ling function.
Apointed Kripke structure is a pair (S, s) where s∈ S. A
path in a structure S= (S, R, `) is an infinite word λover S
such that for all iN, (λi, λi+1)R. For sS, Paths(s)
is the set of all paths that start in s.
2.2 Infinite trees
Let Xbe a finite set. An X-tree τis a nonempty set of
words τX+such that
there exists rX, called the root of τ, such that each
uτstarts with r;
if u·xτwith xXand u6=, then uτ, and
if uτthen there exists xXsuch that u·xτ.
The elements of a tree τare called nodes. If u·xτ, we
say that u·xis a child of u. Similarly to Kripke structures,
apath is an infinite sequence of nodes λ=u0u1. . . such that
for all i,ui+1 is a child of ui, and P aths(u) is the set of paths
that start in node u. An AP-labelled X-tree, or (AP, X)-tree
for short, is a pair t= (τ, `), where τis an X-tree called the
domain of tand `:τ2AP is a labelling.
Definition 1 (Tree unfoldings). Let S= (S, R, `)
be a Kripke structure over AP, and let sS. The tree-
unfolding of Sfrom sis the (AP, S)-tree tS(s)=(τ, `0),
where τis the set of all finite paths that start in s, and for
every uτ,`0(u) = `(s), where sis the last letter of u.
3. ATLWITH IMPERFECT INFORMATION
In this section we recall the syntax and semantics of ATL
with imperfect information and synchronous perfect-recall
semantics, or ATL
ifor short, and establish a meta-theorem
on the decidability of its model-checking problem.
3.1 Definitions
We first introduce the models of the logics we study. For
the rest of the paper, let us fix a non-empty finite set of
agents Ag and a non-empty finite set of moves M.
Definition 2. Aconcurrent game structure with imper-
fect information (or CGSifor short) over AP is a tuple
G= (V, E , `, {∼a}aAg)where Vis a non-empty finite set
of positions,E:V×MAg Vis a transition function,
`:V2AP is a labelling function and for each agent
aAg,aV×Vis an equivalence relation.
In a position vV, each agent achooses a move maM,
and the game proceeds to position E(v, m), where mMAg
stands for the joint move (ma)aAg (note that we assume
E(v, m) to be defined for all vand m2). For each position
vV,`(v) is the finite set of atomic propositions that hold
in v, and for aAg, equivalence relation arepresents the
1i.e., for all sS, there exists s0such that (s, s0)R.
2This assumption, as well as the choice of a unique set of
moves for all agents, is made to ease presentation. All the
results presented here also hold when the set of available
moves depends on the agent and the position.
observation of agent a: for two positions v, v 0V,vav0
means that agent acannot tell the difference between vand
v0. We may write v∈ G for vV. A pointed CGSi(G, v) is
a CGSiGtogether with a position v∈ G.
In Section 3.2 we also use nondeterministic CGSi, which
are as in Definition 2 except that they have a transition re-
lation EV×MAg ×Vinstead of a transition function. In
a position v, after every agent has chosen a move, forming
a joint move mMAg, a special agent called Nature (not
in Ag) chooses a next position v0such that (v, m, v0)E
(see [4] for detail). In the following, unless explicitly speci-
fied, CGSialways refers to deterministic CGSi. The follow-
ing definitions also concern deterministic CGSi, but they
can be adapted to nondeterministic ones in an obvious way.
Afinite (resp. infinite)play is a finite (resp. infinite)
word ρ=v0. . . vn(resp. π=v0v1. . .) such that for all i
with 0 i < |ρ| − 1 (resp. i0), there exists a joint move
msuch that E(vi,m) = vi+1. A finite (resp. infinite) play
ρ(resp. π)starts in a position vif ρ0=v(resp. π0=v).
We let Plays(G, v) be the set of plays, either finite or infinite,
that start in v.
In this work we consider agents with synchronous perfect
recall, meaning that the observational equivalence relation
for each agent ais extended to finite plays the following way:
ρaρ0if |ρ|=|ρ|0and ρiaρ0
ifor every i∈ {0,...,|ρ|−1}.
Astrategy for agent a is a function σ:V+M such that
σ(ρ) = σ(ρ0) whenever ρaρ0. The latter constraint cap-
tures the essence of imperfect information, which is that
agents can base their strategic choices only on the informa-
tion available to them, and removing this constraint yields
the semantics of classic ATL with perfect information.
Astrategy profile for a coalition AAg is a mapping σA
that assigns a strategy to each agent aA; for aA, we
may write σainstead of σA(a). An infinite play πfollows
a strategy profile σAfor a coalition Aif for all i0, there
exists a joint move msuch that E(πi,m) = πi+1 and for
each aA,ma=σa(π[0, i]). For a strategy profile σAand
a position vV, we define the outcome Out(v, σA) of σA
in vas the set of infinite plays that start in vand follow σA.
The syntax of ATL
iis the same as that of ATL, and is
given by the following grammar:
ϕ::= p| ¬ϕ|ϕϕ| hAiϕ|Xϕ|ϕUϕ,
where p∈ AP and AAg.
Xand Uare the classic next and until operators, re-
spectively, while the strategic operator hAiquantifies over
strategy profiles for coalition A.
The semantics of ATL
iis defined with regards to a CGSi
G= (V, E , `, {∼a}aAg), an infinite play πand a position
i0 along this play, by induction on formulas:
G, π, i |=pif p`(πi)
G, π, i |=¬ϕif G, π, i 6|=ϕ
G, π, i |=ϕϕ0if G, π, i |=ϕor G, π, i |=ϕ0
G, π, i |=hAiϕif there exists a strategy profile σAs.t.
for all π0Out(πi, σA), G, π0,0|=ϕ
G, π, i |=Xϕif G, π, i + 1 |=ϕ
G, π, i |=ϕUϕ0if there exists jis.t. G, π, j |=ϕ0and,
for all ks.t. ik < j,G, π, k |=ϕ.
An ATL
iformula ϕis closed if every temporal operator
(Xor U) in ϕis in the scope of a strategic operator hAi.
Since the semantics of a closed formula ϕdoes not depend on
the future, we may write G, v |=ϕ, meaning that G, π, 0|=ϕ
for any infinite play πthat starts in v.
The model-checking problem for ATL
iconsists in deciding,
given a closed ATL
iformula ϕand a finite pointed CGSi
(G, v), whether G, v |=ϕ.
3.2 Model checking ATL
i
It is well known that the model-checking problem for ATL
i
is undecidable for agents with perfect recall [2], as it can eas-
ily express the existence of distributed winning strategies
for multiplayer reachability games with imperfect informa-
tion and perfect recall, which was proved undecidable by
Peterson, Reif and Azhar [27]. A direct proof of this unde-
cidability result for ATL
iis also presented in [11]. However,
there are classes of multiplayer games with imperfect infor-
mation that are decidable. For many years, the only known
decidable case was that of hierarchical games, in which there
is a total preorder among players, each player observing at
least as much as those below her in this preorder [28, 22].
Recently, this result has been extended by relaxing the as-
sumption of hierarchical observation. In particular, it has
been shown that the problem remains decidable if the hier-
archy can change along a play, or if transient phases without
such a hierarchy are allowed [4]. We establish that these re-
sults transfer to the model-checking problem for ATL
i.
We remind that a concurrent game with imperfect infor-
mation is a pair ((G, v), W ) where (G, v ) is a pointed non-
deterministic CGSiand Wis a property of infinite plays
called the winning condition. The strategy problem is, given
such a game, to decide whether there exists a strategy profile
for the grand coalition Ag to enforce the winning condition
against Nature (for more details see, e.g., [4]).
Before stating our meta-theorem we need to introduce a
couple of notions. First we introduce a notion of abstraction
over a group of agents. Informally, abstracting a CGSiG
over an agent consists in erasing her from the group of agents
and letting Nature play for her in G.
Definition 3 (Abstraction). Let AAg be a group
of agents and let G= (V, E , `, {∼a}aAg)be a CGSi. The
abstraction of Gfrom Ais the nondeterministic CGSiover
set of agents Ag\Adefined as G ↑A:= (V, E 0, `, {∼a}aAg\A),
where for every vVand mMAg\A,
(v, m, v0)E0if m0MAs.t. E(v , (m,m0)) = v0.
Thanks to this notion we can define the following problem:
Definition 4 (A-strategy problem). The A-strategy
problem takes as input a pointed CGSi(G, v), a set AAg
of agents and a winning condition W, and returns the an-
swer to the strategy problem for the game ((G ↑Ag\A, v), W ).
The A-strategy problem for (G, v) with winning condition W
thus consists in deciding whether there is a strategy profile
for agents in Ato enforce Wagainst everybody else.
Finally we introduce the following notion, which simply
captures the change of initial position in a game from a
position vto another position v0reachable from v:
Definition 5 (Initial shifting). Let Gbe a CGSiand
let v, v0∈ G . The pointed CGSi(G, v0)is an initial shifting
of (G, v)if v0is reachable from vin G.
We are now ready to state our first result.
Theorem 1. If Cis a class of pointed CGSiclosed under
initial shifting and such that the A-strategy problem with ω-
regular objective is decidable on C, then model checking ATL
i
is decidable on C.
Proof. Let Cbe such a class of pointed CGSi, and let
(ϕ, (G, v)) be an instance of the model-checking problem for
ATL
ion C. A bottom-up algorithm consists in evaluating
each innermost subformula of ϕof the form hAiϕ0, where ϕ0
is thus an LTL formula, on each position v0of Greachable
from v. Evaluating hAiϕ0on v0amounts to solving an in-
stance of the A-strategy problem3with ω-regular objective
(recall that LTL properties are ω-regular). By assumption
(G, v)∈ C, and because Cis closed by initial shifting and
v0is reachable from v, we have that (G, v0)∈ C. Also by
assumption, the A-strategy problem for ω-regular winning
conditions is decidable on C. We thus have an algorithm to
evaluate each hAiϕ0on each v0. One can then mark posi-
tions of the game with fresh atomic propositions indicating
where these formulas hold, and repeat the procedure until
all strategic operators have been eliminated. It then remains
to evaluate a boolean formula in the initial position v.
Let us recall for which classes of nondeterministic CGSi
the strategy problem is known to be decidable. A (nonde-
terministic or deterministic) CGSiGhas hierarchical obser-
vation if there exists a total preorder 4over Ag such that
if a4band vav0, then vbv0. This notion was refined
in [4] to take into account the agents’ memory, using the
notion of information set: for a finite play ρPlays(G, v)
and an agent a, the information set of agent aafter ρis
Ia(ρ) := {ρ0Plays(G, v)|ρaρ0}. A finite play ρyields
hierarchical information if there is a total preorder 4over
Ag such that if a4b, then Ia(ρ)Ib(ρ). If all finite plays
in Plays(G, v) yield hierarchical information for the same
preorder over agents, (G, v) yields static hierarchical infor-
mation. If this preorder can vary depending on the play,
(G, v) yields dynamic hierarchical information. The last gen-
eralisation consists in allowing for transient phases without
hierarchical information: if every infinite play in Plays(G, v)
has infinitely many prefixes that yield hierarchical informa-
tion, (G, v) yields recurring hierarchical information.
Proposition 1. Hierarchical observation as well as static,
dynamic and recurring hierarchical information are preserved
by abstraction.
Proof. Abstraction removes agents without affecting ob-
servations of remaining ones. The result thus follows from
the respective definitions of hierarchical observation and of
static, dynamic and recurring hierarchical information.
Proposition 2. Hierarchical observation as well as static,
dynamic and recurring hierarchical information are preserved
by initial shifting.
This is obvious for hierarchical observation. For the other
cases we establish Lemma 1 below. It is then easy to check
that Proposition 2 holds.
Lemma 1. If a finite play v·ρ·v0·ρ0yields hierarchical
information in (G, v), so does v0·ρ0in (G, v0), with the same
preorder among agents.
3Observe that if A= Ag then G ↑Ag\A=G, and Nature thus
does not do anything. This is coherent with the fact that
for agents with perfect recall hAgiϕEϕ, where Eis the
CTL path quantifier, even for imperfect information.
Proof. Assume that v·ρ·v0·ρ0yields hierarchical infor-
mation in (G, v) with preorder 4over Ag. Suppose towards a
contradiction that there are agents a, b Ag such that a4b
but Ia(v0·ρ0)6⊆ Ib(v0·ρ0). This means that there is v0·ρ00
Plays(G, v0) such that v0·ρ0av0·ρ00 but v0·ρ06∼bv0·ρ00.
By definition of synchronous perfect recall relations we then
have that v·ρ·v0·ρ0av·ρ·v0·ρ00 and v·ρ·v0·ρ06∼bv·ρ·v0·ρ00.
This implies that Ia(v·ρ·v0·ρ0)6⊆ Ib(v·ρ·v0·ρ0), which
contradicts the fact that a4b. Therefore for all agents a, b
such that a4bwe have Ia(v0·ρ0)Ib(v0·ρ0), and thus
v0·ρ0yields hierarchical information with preorder 4.
Let Cobs (resp. Cstat,Cdyn ,Crec) be the class of pointed
CGSiwith hierarchical observation (resp. static, dynamic,
recurring hierarchical information). We instantiate Theo-
rem 1 to obtain three decidability results for ATL
i.
Theorem 2. Model checking ATL
iis decidable on the
class of CGSiwith hierarchical observation.
Proof. By Proposition 2, Cobs is closed under initial shift-
ing. It is proven in [22] that the strategy problem is decid-
able for games with hierarchical observation and ω-regular
objectives. Since, by Proposition 1, all pointed nondeter-
ministic CGSiobtained by abstracting agents from CGSiin
Cobs also yield hierarchical observation, we get that the A-
strategy problem with ω-regular objectives is decidable on
Cobs. We can therefore apply Theorem 1 on Cobs.
It is proven in [4] that the strategy problem with ω-regular
objectives is also decidable for games with static hierarchical
information and for games with dynamic hierarchical infor-
mation. Since Proposition 1 and Proposition 2 also hold for
Cstat and Cdyn, with the same argument as in the proof of
Theorem 2, we obtain the following results as consequences
of Theorem 1:
Theorem 3. Model checking ATL
iis decidable on the
class of CGSiwith static hierarchical information.
Theorem 4. Model checking ATL
iis decidable on the
class of CGSiwith dynamic hierarchical information.
Note that in fact, since Cobs ⊂ Cstat ⊂ Cdyn, Theorem 2
and Theorem 3 are also obtained as corollaries of Theorem 4,
but we wanted to illustrate how Theorem 1 can be applied
to obtain decidability results for different classes of CGSi.
Remark 1. The last result in [4] establishes that the strat-
egy problem is decidable for games with recurring hierarchi-
cal information, but only for observable ω-regular winning
conditions, i.e., when all agents can tell whether a play is
winning or not. Now considering ATL
ion Cdyn we could
require atomic propositions to be observable for all agents;
in that case we could evaluate the inner-most strategy quan-
tifiers using the above-mentioned result. But then the fresh
atomic propositions that mark positions where these subfor-
mulas hold (see the proof of Theorem 1) would not, in gen-
eral, be observable by all agents. So on Crec we could obtain
a decision procedure for the fragment of ATL
iwithout nested
non-trivial strategy quantifiers, where “non-trivial” means
for coalitions other than the empty coalition or the one made
of all agents (which, we recall, are simply the CTL path quan-
tifiers). We do not state it explicitly due to lack of space and
because it does not seem of much interest.
Concerning complexity, the strategy problem for games
with imperfect information and hierarchical observation is
already nonelementary [29, 27], hence the following result:
Corollary 1. Model checking ATL
iis nonelementary
on games with hierarchical observation, hence also for games
with static or dynamic hierarchical information.
We now turn to ATL with imperfect information and strat-
egy context, and study its model-checking problem.
4. ATLiWITH STRATEGY CONTEXT
While in ATL strategies for all agents are forgotten each
time a new strategy quantifier is met, in ATL with strat-
egy context (ATLsc ) [5, 9, 24] agents keep using the same
strategy as long as the formula does not say otherwise. In
this section we consider ATLsc with imperfect information
(ATLsc,i). As far as we know, the only existing work on
this logic is [25], which proved its model-checking problem
to be decidable in the case where all agents have the same
observation of the game. We extend significantly this result
by establishing that the model-checking problem is decid-
able as long as strategy quantification is hierarchical, in the
sense that if there is a strategy quantification for agent a
nested in a strategy quantification for agent b, then bshould
observe no more than a. In other terms, innermost strategic
quantifications should concern agents who observe more.
4.1 Syntax and semantics
The models are still CGSi. To remember which agents are
currently bound to a strategy, and what these strategies are,
the semantics uses strategy contexts. Formally, a strategy
context for a set of agents BAg is a strategy profile σB.
We define the composition of strategy contexts as follows.
If σBis a strategy context for Band σAis a new strategy
profile for coalition A, we let σAσBbe the strategy context
for ABdefined as σAB:a7→ (σA(a) if aA,
σB(a) otherwise .
So if ais assigned a strategy by σA, her strategy in σAσB
is σA(a). If she is not assigned a strategy by σAher strategy
remains the one given by σB, if any.
Also, given a strategy context σBand a set of agents
AAg, we let (σB)\Abe the strategy context obtained
by restricting σBto the domain B\A.
Finally, because agents who do not change their strategy
keep playing the one they were assigned, if any, we cannot
forget the past at each strategy quantifier, as in the seman-
tics of ATL
i(see Section 3.1). We thus define the outcome of
a strategy profile σAafter a finite play ρ, written Out(ρ, σA),
as the set of infinite plays πthat start with ρand then fol-
low σA:πOut(ρ, σA) if π=ρ·π0for some π0, and for all
i≥ |ρ| − 1, there exists a joint move mMAg such that
E(πi,m) = πi+1 and for each aA,ma=σa(π[0, i]).
To differentiate from ATL, in ATL
sc the strategy quanti-
fier for a coalition Ais written h·A·i instead of hAi.ATL
sc
also has an additional operator, (|A|), that releases agents in
Afrom their current strategy, if they have one. The syntax
of ATL
sc,i is the same as that of ATL
sc and is thus given by
the following grammar:
ϕ::= p| ¬ϕ|ϕϕ| h·A·iϕ|(|A|)ϕ|Xϕ|ϕUϕ,
where p∈ AP and AAg. We use standard abbreviations:
>:= p∨ ¬p,:= ¬>,Fϕ:= >Uϕ, and Gϕ:= ¬F¬ϕ.
Remark 2. In [24] the syntax of ATL
sc contains in ad-
dition operators h·A·i and (|A|)for complement coalitions.
While they add expressivity when the set of agents is not
fixed, and are thus of interest when considering expressiv-
ity or satisfiability, they are redundant if we consider model
checking, which is our case in this work. To simplify pre-
sentation we thus choose not to consider them here.
The semantics of ATL
sc,i is defined with regards to a CGSi
G= (V, E , `, {∼a}aAg), an infinite play π, a position iN
along this play, and a strategy context σB. The semantics
is defined by induction on formulas:
G, π, i |=σBpif p`(πi)
G, π, i |=σB¬ϕif G, π, i 6|=σBϕ
G, π, i |=σBϕϕ0if G, π, i |=σBϕor G, π, i |=σBϕ0
G, π, i |=σBh·A·iϕif there exists a strategy profile σAs.t.
for all π0Out(π[0, i], σAσB),
G, π0, i |=σAσBϕ
G, π, i |=σB(|A|)ϕif G, π, i |=(σB)\Aϕ
G, π, i |=σBXϕif G, π, i + 1 |=σBϕ
G, π, i |=σBϕUϕ0if there exists jis.t. G, π, j |=σBϕ0
and, for all ksuch that ik < j,
G, π, k |=σBϕ.
The notion of closed formula is as defined in Section 3.1
and once more, the semantics of a closed formula ϕbeing
independent from the future, we may write G, v |=σBϕin-
stead of G, π, 0|=σBϕfor any infinite play πthat starts in
position v. We also write G, v |=ϕif G, v |=σϕ, that is if
ϕholds in vwith the empty strategy context.
The model-checking problem for ATL
sc,i consists in decid-
ing, given a closed ATL
sc,i formula ϕand a finite pointed
CGSi(G, v), whether G, v |=ϕ.
We now present QCTLwith imperfect information, or
QCTL
ifor short, before proving our main result on the
model-checking problem for ATL
sc,i by reducing it to the
model-checking problem for a decidable fragment of QCTL
i.
4.2 QCTLwith imperfect information
Quantified CTL, or QCTLfor short, is an extension of
CTLwith second-order quantifiers on atomic propositions
that has been well studied [33, 20, 21, 23]. It has recently
been further extended to take into account imperfect infor-
mation, resulting in the logic called QCTLwith imperfect
information, or QCTL
i[3]. We briefly present this logic, as
well as a decidability result on its model-checking problem
proved in [3] and that we rely on to establish our result on
the model checking of ATL
sc,i.
Imperfect information is incorporated into QCTLby con-
sidering Kripke models with internal structure in the form of
local states, like in distributed systems (see for instance [17]),
and then parameterising quantifiers on atomic propositions
with observations that define what portions of the states
a quantifier can “observe”. The semantics is then adapted
to capture the idea of quantification on atomic propositions
being made with partial observation.
Let us fix a collection {Li}i[n]of ndisjoint finite sets of
local states. We also let Xn=L1×. . . ×Ln.
Definition 6. Acompound Kripke structure (CKS) over
AP is a Kripke structure S= (S, R, `)such that SXn.
The syntax of QCTL
iis that of QCTL, except that quan-
tifiers over atomic propositions are parameterised by a set
of indices that defines what local states the quantifier can
“observe”. It is thus defined by the following grammar:
ϕ:= p| ¬ϕ|ϕϕ|Eϕ| ∃op. ϕ |Xϕ|ϕUϕ
where p∈ AP and oNis a finite set of indices. As usual,
we let Aϕ:= ¬E¬ϕ.
A finite set oNis called an observation, and two states
s= (l1,...,ln) and s0= (l0
1,...,l0
n) are o-indistinguishable,
written sos0, if for all i[n]o, it holds that li=l0
i.
The intuition is that a quantifier with observation omust
choose the valuation of atomic propositions uniformly with
respect to o. Note that in [3], two semantics are considered
for QCTL
i, just like in [23] for QCTL: the structure se-
mantics and the tree semantics. In the former, formulas are
evaluated directly on the structure, while in the latter the
structure is first unfolded into an infinite tree. Here we only
present the tree semantics, as it is this one that allows us to
capture agents with perfect recall. But we first need a few
more definitions.
For p∈ AP, two labelled trees t= (τ, `) and t0= (τ0, `0)
are equivalent modulo p, written tpt0, if τ=τ0and for
each node uτ,`(u)\ {p}=`0(u)\ {p}. So tpt0if they
are the same trees, except for the labelling of proposition p.
This notion of equivalence modulo pis the one used to
define quantification on atomic propositions in QCTL: in-
tuitively, an existential quantification over pchooses a new
labelling for valuation p, all else remaining the same, and the
evaluation of the formula continues from the current node
with the new labelling. For imperfect information we need
to express the fact that this new labelling for a proposition is
done uniformly with regards to the quantifier’s observation.
First, we define the notion of indistinguishability between
two nodes in the unfolding of a CKS. Let obe an observation,
let τbe an Xn-tree (which may be obtained by unfolding
some pointed CKS), and let u=s0. . . siand u0=s0
0. . . s0
jbe
two nodes in τ. The nodes uand u0are o-indistinguishable,
written uou0, if i=jand for all k∈ {0,...,i}, we have
skos0
k. Observe that this definition corresponds to the no-
tion of synchronous perfect recall in CGSi(see Section 3.1).
We now define what it means for the labelling of an atomic
proposition to be uniform with regards to an observation.
Definition 7. Let t= (τ, `)be a labelled Xn-tree, let
p∈ AP be an atomic proposition and oNan observation.
Tree tis o-uniform in pif for every pair of nodes u, u0τ
such that uou0, we have p`(u)iff p`(u0).
The satisfaction relation |=t(tis for tree semantics) is now
defined as follows, where t= (τ, `) is a labelled Xn-tree, λ
is a path in τand iNa position along that branch:
t, λ, i |=tpif p`(λi)
t, λ, i |=t¬ϕif t, λ, i 6|=tϕ
t, λ, i |=tϕϕ0if t, λ, i |=tϕor t, λ, i |=tϕ0
t, λ, i |=tEϕif there exists λ0P aths(λi)
such that t, λ0,0|=tϕ
t, λ, i |=top. ϕ if there exists t0ptsuch that
t0is o-uniform in pand t0, λ, i |=tϕ
t, λ, i |=tXϕif t, λ, i + 1 |=tϕ
t, λ, i |=tϕUϕ0if there exists jisuch that t, λ, j |=tϕ0
and for ik < j, t, λ, j |=tϕ
Similarly to ATL
iand ATL
sc,i, we say that a QCTL
ifor-
mula is closed if all temporal operators are in the scope of a
path quantifier. The semantics of such formulas depending
only on the current node, for a closed formula ϕwe may
write t|=tϕfor t, r |=tϕ, where ris the root of t, and
given a CGSiG, a state sand a QCTL
iformula ϕ, we write
S, s |=tϕif tS(s)|=tϕ.
Remark 3. In [3] the syntax is presented with path for-
mulas distinguished from state formulas, and the semantics
is defined accordingly. To make the presentation more uni-
form with that of ATLsc,i we chose here a different, but equiv-
alent, presentation.
Remark 4. Note that when nis fixed, the propositional
quantifier with perfect information from QCTLis equivalent
to the QCTL
iquantifier that observes all the components,
i.e., the quantifier parameterised with observation [n].
The model-checking problem for QCTL
iis the following:
given a closed QCTL
iformula ϕand a finite pointed CKS
(S, s), decide whether S, s |=tϕ.
We now define the class of QCTL
iformulas for which the
model-checking problem is known to be decidable with the
tree semantics.
Definition 8. AQCTL
iformula ϕis hierarchical if for
all subformulas ϕ1, ϕ2of the form ϕ1=o1p1. ϕ0
1and ϕ2=
o2p2. ϕ0
2where ϕ2is a subformula of ϕ0
1, we have o1o2.
The following result is proved in [3], where QCTL
i,is the
set of hierarchical QCTL
iformulas:
Theorem 5 ([3]). Model checking QCTL
i,with tree
semantics is decidable.
4.3 Model checking ATL
sc,i
We establish that model checking ATL
sc,i is decidable on
a class of instances whose definition relies on the notion of
hierarchical observation.
Definition 9. Let G= (V, E, `, {∼a}aAg )be a CGSi,
and let a, b Ag be two agents. Agent aobserves no more
than agent bin G, written a4Gb, if for every pair of po-
sitions v, v0V,vbv0implies vav0. We say that
AAg is hierarchical in Gif 4Gis a total preorder on A.
If a set of agents Ais hierarchical in a CGSiG, we thus
may talk about maximal and minimal agents in A, referring
to maximal and minimal elements of Afor the relation 4G.
The essence of the requirement that makes the problem
decidable is the same as for the decidability result on QCTL
i
(Theorem 5): nesting of quantifiers (here, strategy quan-
tifiers) should be hierarchical, with those observing more
inside those observing less. However, unlike in QCTL
i, in
ATL
sc,i observations are not part of formulas, but rather
they are given by the models. We thus define the notion of
hierarchical ATL
sc,i formula with respect to a given CGSi:
Definition 10. Let Φbe an ATL
sc,i formula and Ga
CGSi. We say that Φis hierarchical in Gif:
for every subformula ϕof the form ϕ=h·A·iϕ0,Ais
hierarchical in G, and
for all subformulas ϕ1, ϕ2of the form ϕ1=h·A1·iϕ0
1
and ϕ2=h·A2·iϕ0
2where ϕ2is a subformula of ϕ0
1,
maximal agents of A1observe no more than minimal
agents of A2.
An instance ,(G, v)) of the model-checking problem for
ATL
sc,i is hierarchical if Φis hierarchical in G.
In the rest of the section we establish the following:
Theorem 6. Model checking ATL
sc,i is decidable on the
class of hierarchical instances.
We build upon the proof in [24] that establishes the decid-
ability of the model-checking problem for ATL
sc by reduc-
tion to the model-checking problem for QCTL. The main
difference is that we reduce to the model-checking problem
for QCTL
iinstead, using quantifiers parameterised with ob-
servations corresponding to agents’ observations. We also
need to make a couple of adjustments to obtain formulas in
the decidable fragment QCTL
i,.
Let (Φ,(G, vι)) be a hierarchical instance of the ATL
sc,i
model-checking problem, where G= (V, E, `, {∼a}aAg ) is a
CGSiover AP. In the reduction we will transform Φ into
an equivalent QCTL
iformula Φ0in which we need to refer
to the current position in the model G, and also to talk
about moves taken by agents. To do so, we consider the
additional sets of atomic propositions APv:= {pv|vV}
and APm:= {pa
m|aAg and mM}, that we take
disjoint from AP.
First we define the CKS SGon which Φ0will be evalu-
ated. Since the models of the two logics use different ways
to represent imperfect information (equivalence relations on
positions for CGSiand local states for CKS) this requires a
bit of work. First, for each vVand aAg, let us de-
fine [v]aas the equivalence class of vfor relation a. Now,
noting Ag = {a1,...,an}, we define for each i[n] the set
Li:= {[v]ai|vV}of local states for agent ai. Since we
need to know the actual position of the CGSito define the
dynamics, we also let Ln+1 := V. States of SGwill thus
be tuples in L1×. . . ×Ln×Ln+1. For each v∈ G, let
sv:= ([v]a1,...,[v]an, v) be its corresponding state in SG.
We can now define SG:= (S, R, `0), where
S:= {sv|vV},
R:= {(sv, sv0)| ∃mMAg s.t. E(v, m) = v0}, and
`0(sv) := `(v)∪ {pv}.
To make the connection between finite plays in Gand
nodes in tree unfoldings of SG, let us define, for every finite
play ρ=v0. . . vk, the node uρ:= sv0. . . svkin tSG(sv0)
(which exists, by definition of SGand of tree unfoldings).
Observe that the mapping ρ7→ uρis in fact a bijection
between the set of finite plays starting in a given position v
and the set of nodes in tSG(sv).
Now it should be clear that giving to a propositional quan-
tifier in QCTL
iobservation oi:= {i}, for i[n], amounts to
giving him the same observation as agent ai. Formally, one
can prove the following lemma, simply by applying the def-
initions of observational equivalence in the two frameworks:
Lemma 2. For all finite plays ρ, ρ0starting in position v,
ρaiρ0iff uρoiuρ0in tSG(sv).
We now describe the translation4from ATLsc,i formulas
to QCTL
iformulas. First we recall the translation from [24]
for the perfect-information case.
The translation from ATLsc to QCTLis parameterised
by a coalition BAg, that conveys the set of agents who
4Here we abuse language: the construction depends on the
model Gand is therefore not a translation in the usual sense.
are currently bound to a strategy. It is defined by induction
on Φ as follows:
pB:= p¬ϕB:= ¬ϕB
ϕϕ0B:= ϕBϕ0B(|A|)ϕB:= ϕB\A
XϕB:= XϕBϕUϕ0B:= ϕBUϕ0B
The only non-trivial case is for formulas of the form h·A·iϕ.
For the rest of the section, we let M = {m1,...,ml}. Now,
if A={ai1,...,aik}, we define
h·A·iϕB:= mai1
1. . . mai1
l. . . maik
1. . . maik
lpout.
Φstrat(A)Φout (AB)A(Gpout ϕAB),
where
Φstrat(A) := ^
aA
AG _
mM
(ma^
m06=m
¬m0a)
and
Φout(A) := pout AG [¬pout AX¬pout]AG
pout
_
vV_
mMA
pvpmAX
_
v0E(v,m)
pv0pout
.
In Φout(A), for m= (ma)aAMA, notation pmstands
for the propositional formula VaAma
awhich characterizes
the joint move mthat agents in Aplay in v. Also, E(v , m)
is the set of possible next positions when the current one is
vand agents in Aplay m, and it is defined as E(v, m) :=
{E(v, (m,m0)) |m0MAg\A}.
The idea of this translation is the following: first, for each
agent aAand each possible move mM, an existential
quantification on the atomic proposition ma“chooses” for
each finite play ρof (G, vι) (or, equivalently, for each node
uρof tSG(svι)) whether agent aplays move min ρor not,
coded by mabeing chosen to be true a in ρor not. Formula
Φstrat(A) ensures that each agent achooses exactly one move
in each finite play, and thus that atomic propositions ma
characterise a strategy for her. An atomic proposition pout
is then used to mark the paths that follow the currently
fixed strategies: formula Φout(AB) states that pout marks
exactly the outcome of strategies just chosen for agents in A,
as well as those of agents in B, that were chosen previously
by a strategy quantifier “higher” in Φ.
Note that we simplified slightly Φstrat(A) and Φout(A),
using the fact that unlike in [24], we have assumed in our
definition of CGSithat the set of available moves is the same
for all agents in all positions (see Footnote 2).
It is proven in [24] that this translation is correct, in the
sense that for every ATLsc closed formula ϕand pointed
perfect-information concurrent game structure (G, v), letting
SGbe as described above but removing the local states for
all agents and keeping only the Ln+1 component, we have:
G, v |=ϕiff tSG(sv)|=tϕ.
We now explain how to adapt this translation to the case of
imperfect information. Observe that the only difference be-
tween ATL
sc and ATL
sc,i is that in the latter, strategies must
be defined uniformly over indistinguishable finite plays, i.e.,
a strategy σfor an agent amust be such that if ρaρ0, then
σ(ρ) = σ(ρ0). To enforce that the strategies coded by atomic
propositions main h·A·iϕBare uniform, we use the propo-
sitional quantifiers with partial observation of QCTL
i. For-
mally, we define a translation fBfrom ATL
sc,i to QCTL
i.
It is defined exactly as the one from ATL
sc to QCTL, except
for the following inductive case.
If A={ai1,...,aik}we let
^
h·A·iϕ
B
:= oi1mai1
1. . . mai1
l. . . oikmaik
1. . . maik
lpout.
Φstrat(A)Φout (AB)A(Gpout eϕAB),
where Φstrat(A) and Φout (A) are defined as before, and pout
is a macro for {1,...,n+1}pout (see Remark 4).
So the only difference from the previous translation is
that now, the labelling of each atomic proposition maimust
be oi-uniform. This means that if two nodes uand u0in
tSG(svι) are oi-indistinguishable, then uis labelled with mai
if and only if u0also is. In other words, in the strategy coded
by atomic propositions mai, agent aiplays min uif and only
if she also plays it in u0, and thus this strategy is uniform
(recall that, by Lemma 2, observation oicorrectly reflects
agent ai’s observation in tSG(svι)). It is then clear that this
translation is correct:
G, vι|= Φ iff tSG(svι)|=te
Φ.(1)
However, even if we have taken (Φ,(G, vι)) to be a hierar-
chical instance, e
Φis not in the decidable fragment QCTL
i,.
Indeed, with the current definition of observations {oi}i[n],
hierarchical observation in Gdoes not imply hierarchical ob-
servation in SG: since oi={i}, for i6=jit is never the
case that oioj. Still, we note that if agent ajobserves no
more than agent ai, then letting aisee also what agent aj
sees does not increase her knowledge of the situation:
Lemma 3. If aj4Gai, then for all finite plays ρ, ρ0that
start in the same position, uρoiuρ0iff uρoiojuρ0.
Proof. Assume that aj4Gai. It is enough to see that
for every pair of states sv, sv0in SG, we have svoisv0iff
svoiojsv0. The right-to-left implication is obvious: if two
states have the same i-th and j-th components, in particular
they have the same i-th component. For the other direction,
assume that svoisv0. This means that [v]ai= [v0]ai,
and thus that vaiv0. Since aj4Gai, we also have that
vajv0, and thus that [v]aj= [v0]aj, and it follows that
svoiojsv0.
In the light of this Lemma 3, we can safely redefine obser-
vations as follows: for each i[n], we let
o0
i:= [
j|aj4Gai
oj.
Observe that in fact o0
i={j|aj4Gai}. Informally, a
quantifier with observation o0
isees what agent aiobserves
(note that 4Gis reflexive), as well as what agents that see
no more than aiobserve.
Let us define a new version of the translation fB. First,
Φ being hierarchical in G, for each subformula of Φ of the
form h·A·iϕwe have that Ais hierarchical in G. It is thus pos-
sible to choose for agents in Aan indexing A={ai1,...,aik}
such that for all 1 c < d k, we have aic4Gaid.
Now the translation remains the same as before except for
the following inductive case:
If A={ai1,...,aik}, where for all 1 c < d k, we
have aic4Gaid, we let
^
h·A·iϕ
B
:= o0
i1mai1
1. . . mai1
l. . . o0
ikmaik
1. . . maik
lpout.
Φstrat(A)Φout (AB)A(Gpout eϕAB),
where Φstrat(A) and Φout (A) are defined as before.
From Lemma 3 we have that this new translation is still
correct in the sense of Equation (1). In addition, for all
1c < d kwe have o0
ico0
id.
Now consider formula e
Φ. Because Φ is hierarchical in G,
for every pair of subformulas ϕ1, ϕ2of the form ϕ1=h·A1·iϕ0
1
and ϕ2=h·A2·iϕ0
2where ϕ2is a subformula of ϕ0
1, maximal
agents of A1observe no more than minimal agents of A2.
It is then easy to see that e
Φwould be hierarchical if there
were not the perfect-information quantifications on atomic
proposition pout that break the monotony of observations
along subformulas when there are nested strategic quanti-
fiers. We explain how to remedy this last problem.
We remove altogether proposition pout, and we use instead
the formula ψout(A) defined below to characterise which
paths are in the outcome of the currently-fixed strategies:
ψout(A) := G
^
vV^
mMA
pvpmX_
v0E(v,m)
pv0
.
Clearly, this formula holds in a path λof tSG(svι) marked
with propositions macharacterising strategies for agents in
A, if at each point along λcorresponding to some position
v, the next point in λcorresponds to a position v0that can
be attained from vwhen agents in Aeach play the move
prescribed by their current strategy. The last modification
to fBis thus the following:
If A={ai1,...,aik}, where for all 1 c < d k, we
have aic4Gaid, we let
^
h·A·iϕ
B
:= o0
i1mai1
1. . . mai1
l. . . o0
ikmaik
1. . . maik
l.
Φstrat(A)Aψout (AB)eϕAB,
where Φstrat(A) is defined as before.
It follows from the above considerations that this transla-
tion is still correct in the sense of Equation (1), and one can
check that e
Φis a hierarchical QCTL
iformula. We conclude
the proof by recalling that by Theorem 5, model checking
QCTL
i,is decidable.
Concerning complexity, model checking ATLsc being al-
ready nonelementary [24], so is it for ATLsc,i .
5. CONCLUSION
In this work we established new decidability results for
the model-checking problem of ATLwith imperfect infor-
mation and perfect recall as well as its extension with strat-
egy context. Should new decidable classes of multiplayer
games with imperfect information be discovered, and assum-
ing the reasonable property of closure under initial shifting,
our transfer theorem (Theorem 1) would entail new decid-
ability results also for ATL
i. As for ATL
sc,i, it would be
interesting to investigate whether a meaningful notion of
hierarchical instances based on, e.g., dynamic or recurring
hierarchical information instead of hierarchical observation
as here, could lead to stronger decidability results.
REFERENCES
[1] T. Agotnes, V. Goranko, and W. Jamroga.
Alternating-Time Temporal Logics with Irrevocable
Strategies. In TARK, pages 15–24, 2007.
[2] R. Alur, T. Henzinger, and O. Kupferman.
Alternating-Time Temporal Logic. J. ACM,
49(5):672–713, 2002.
[3] R. Berthon, B. Maubert, and A. Murano. Quantified
CTL with imperfect information. CoRR,
abs/1611.03524, 2016.
[4] D. Berwanger, A. B. Mathew, and M. van den
Bogaard. Hierarchical information patterns and
distributed strategy synthesis. In Automated
Technology for Verification and Analysis - 13th
International Symposium, ATVA 2015, Shanghai,
China, October 12-15, 2015, Proceedings, pages
378–393, 2015.
[5] T. Brihaye, A. D. C. Lopes, F. Laroussinie, and
N. Markey. ATL with strategy contexts and bounded
memory. In Logical Foundations of Computer Science,
International Symposium, LFCS 2009, Deerfield
Beach, FL, USA, January 3-6, 2009. Proceedings,
pages 92–106, 2009.
[6] N. Bulling and W. Jamroga. Comparing variants of
strategic ability: how uncertainty and memory
influence general properties of games. Autonomous
Agents and Multi-Agent Systems, 28(3):474–518, 2014.
[7] E. Clarke and E. Emerson. Design and Synthesis of
Synchronization Skeletons Using Branching-Time
Temporal Logic. In 81, LNCS 131, pages 52–71, 1981.
[8] E. Clarke, O. Grumberg, and D. Peled. Model
Checking. 2002.
[9] A. Da Costa, F. Laroussinie, and N. Markey. ATL
with Strategy Contexts: Expressiveness and Model
Checking. In FSTTCS’10, LIPIcs 8, pages 120–132,
2010.
[10] C. Dima, C. Enea, and D. P. Guelev. Model-checking
an alternating-time temporal logic with knowledge,
imperfect information, perfect recall and
communicating coalitions. In Proceedings First
Symposium on Games, Automata, Logic, and Formal
Verification, GANDALF 2010, Minori (Amalfi Coast),
Italy, 17-18th June 2010., pages 103–117, 2010.
[11] C. Dima and F. L. Tiplea. Model-checking ATL under
imperfect information and perfect recall semantics is
undecidable. CoRR, abs/1102.4225, 2011.
[12] R. Fagin, J. Y. Halpern, Y. Moses, and M. Y. Vardi.
Reasoning about knowledge, volume 4. MIT press
Cambridge, 1995.
[13] B. Finkbeiner and S. Schewe. Uniform distributed
synthesis. In 20th IEEE Symposium on Logic in
Computer Science (LICS 2005), 26-29 June 2005,
Chicago, IL, USA, Proceedings, pages 321–330, 2005.
[14] T. French. Decidability of quantifed propositional
branching time logics. In Australian Joint Conference
on Artificial Intelligence, pages 165–176. Springer,
2001.
[15] D. P. Guelev and C. Dima. Model-checking strategic
ability and knowledge of the past of communicating
coalitions. In Declarative Agent Languages and
Technologies VI, 6th International Workshop, DALT
2008, Estoril, Portugal, May 12, 2008, Revised
Selected and Invited Papers, pages 75–90, 2008.
[16] D. P. Guelev, C. Dima, and C. Enea. An
alternating-time temporal logic with knowledge,
perfect recall and past: axiomatisation and
model-checking. Journal of Applied Non-Classical
Logics, 21(1):93–131, 2011.
[17] J. Y. Halpern and M. Y. Vardi. The complexity of
reasoning about knowledge and time. i. lower bounds.
Journal of Computer and System Sciences,
38(1):195–237, 1989.
[18] W. Jamroga and W. van der Hoek. Agents that Know
How to Play. 63(2-3):185–219, 2004.
[19] P. Kazmierczak, T. ˚
Agotnes, and W. Jamroga.
Multi-agency is coordination and (limited)
communication. In PRIMA 2014: Principles and
Practice of Multi-Agent Systems - 17th International
Conference, Gold Coast, QLD, Australia, December
1-5, 2014. Proceedings, pages 91–106, 2014.
[20] O. Kupferman. Augmenting branching temporal logics
with existential quantification over atomic
propositions. In CAV’95, LNCS 939, pages 325–338.
Springer, 1995.
[21] O. Kupferman, P. Madhusudan, P. S. Thiagarajan,
and M. Y. Vardi. Open systems in reactive
environments: Control and synthesis. In CONCUR’00,
LNCS 1877, pages 92–107. Springer, 2000.
[22] O. Kupferman and M. Y. Vardi. Synthesizing
distributed systems. In 16th Annual IEEE Symposium
on Logic in Computer Science, Boston, Massachusetts,
USA, June 16-19, 2001, Proceedings, pages 389–398,
2001.
[23] F. Laroussinie and N. Markey. Quantified CTL:
expressiveness and complexity. Logical Methods in
Computer Science, 10(4), 2014.
[24] F. Laroussinie and N. Markey. Augmenting ATL with
strategy contexts. Inf. Comput., 245:98–123, 2015.
[25] F. Laroussinie, N. Markey, and A. Sangnier. ATLsc
with partial observation. In Proceedings Sixth
International Symposium on Games, Automata, Logics
and Formal Verification, GandALF 2015, Genoa,
Italy, 21-22nd September 2015., pages 43–57, 2015.
[26] M. Pauly. A Modal Logic for Coalitional Power in
Games. 12(1):149–166, 2002.
[27] G. Peterson, J. Reif, and S. Azhar. Lower bounds for
multiplayer noncooperative games of incomplete
information. Computers & Mathematics with
Applications, 41(7):957–992, 2001.
[28] G. Peterson, J. Reif, and S. Azhar. Decision
algorithms for multiplayer noncooperative games of
incomplete information. Computers & Mathematics
with Applications, 43(1):179–206, 2002.
[29] A. Pnueli and R. Rosner. Distributed reactive systems
are hard to synthesize. In 31st Annual Symposium on
Foundations of Computer Science, St. Louis,
Missouri, USA, October 22-24, 1990, Volume II, pages
746–757, 1990.
[30] J. Queille and J. Sifakis. Specification and Verification
of Concurrent Programs in Cesar. In 81, LNCS 137,
pages 337–351, 1981.
[31] S. Schewe and B. Finkbeiner. Distributed synthesis for
alternating-time logics. In Automated Technology for
Verification and Analysis, 5th International
Symposium, ATVA 2007, Tokyo, Japan, October
22-25, 2007, Proceedings, pages 268–283, 2007.
[32] P. Schobbens. Alternating-Time Logic with Imperfect
Recall. ENTCS, 85(2):82–93, 2004.
[33] A. Sistla. Theoretical Issues in the Design and
Cerification of Distributed Systems. PhD thesis,
Harvard University, Cambridge, MA, USA, 1983.
[34] D. Walther, W. van der Hoek, and M. Wooldridge.
Alternating-Time Temporal Logic with Explicit
Strategies. In TARK, pages 269–278, 2007.
... Game theory models of conflict among rational agents are used in terrorism risk analysis, cyber security, competitive marketing and advertising, and military strategy. Game theory also models the emergence and maintenance of cooperation among agents over time and the formation of coalitions and negotiation and stability of agreements with imperfect monitoring and enforcement (Berthon, Maubert, & Murano, 2017). ...
... However, it is decidable if either the state or all actions taken by agents are public, i.e., observed by all agents (possibly after a finite number of rounds of nonpublic communication during which collusion among subsets of agents may take place) (Belardinelli, Lomuscio, Murano, & Rubin, 2018). Thus, there is a close connection between the information available to agents and the decidability of safety and reachability questions in MAS models (Berthon et al., 2017). ...
... Whether a player has a winning strategy is also undecidable for some real multiplayer noncooperative games (e.g., the popular cardtrading game Magic: The Gathering) (Churchill, 2019). Restricting games in various ways (e.g., to assure that they end in finite time with probability 1, or that player strategies use only finite amounts of memory) can sometimes restore decidability of the existence of winning strategies, making exploration of the exact boundary between decidable and undecidable questions for games an exciting area for current mathematical research (Auger & Teytaud, 2012;Berthon et al., 2017). ...
Article
Decision analysis and risk analysis have grown up around a set of organizing questions: what might go wrong, how likely is it to do so, how bad might the consequences be, what should be done to maximize expected utility and minimize expected loss or regret, and how large are the remaining risks? In probabilistic causal models capable of representing unpredictable and novel events, probabilities for what will happen, and even what is possible, cannot necessarily be determined in advance. Standard decision and risk analysis questions become inherently unanswerable ("undecidable") for realistically complex causal systems with "open-world" uncertainties about what exists, what can happen, what other agents know, and how they will act. Recent artificial intelligence (AI) techniques enable agents (e.g., robots, drone swarms, and automatic controllers) to learn, plan, and act effectively despite open-world uncertainties in a host of practical applications, from robotics and autonomous vehicles to industrial engineering, transportation and logistics automation, and industrial process control. This article offers an AI/machine learning perspective on recent ideas for making decision and risk analysis (even) more useful. It reviews undecidability results and recent principles and methods for enabling intelligent agents to learn what works and how to complete useful tasks, adjust plans as needed, and achieve multiple goals safely and reasonably efficiently when possible, despite open-world uncertainties and unpredictable events. In the near future, these principles could contribute to the formulation and effective implementation of more effective plans and policies in business, regulation, and public policy, as well as in engineering, disaster management, and military and civil defense operations. They can extend traditional decision and risk analysis to deal more successfully with open-world novelty and unpredictable events in large-scale real-world planning, policymaking, and risk management.
... In order to evaluate the practical performance of our tool and approach (against MCMAS and PRALINE), we present results on the temporal equilibrium analysis for the examples in Section 8.2. We ran the tools on the two examples with di erent 13 We assume arithmetic modulo (|N| + 1) in this example. E ("ν"), E N (" "), and A N ("α"). ...
... e paper also solves the problem in practice for perfect information games. We also plan to investigate if our main algorithms can be extended to decidable classes of imperfect information games, for instance, as those studied to model the behaviour of multi-agent systems in [47,12,10,13]. Whenever possible, such studies will be complemented with practical implementations in EVE. ...
Preprint
Full-text available
In the context of multi-agent systems, the rational verification problem is concerned with checking which temporal logic properties will hold in a system when its constituent agents are assumed to behave rationally and strategically in pursuit of individual objectives. Typically, those objectives are expressed as temporal logic formulae which the relevant agent desires to see satisfied. Unfortunately, rational verification is computationally complex, and requires specialised techniques in order to obtain practically useable implementations. In this paper, we present such a technique. This technique relies on a reduction of the rational verification problem to the solution of a collection of parity games. Our approach has been implemented in the Equilibrium Verification Environment (EVE) system. The EVE system takes as input a model of a concurrent/multi-agent system represented using the Simple Reactive Modules Language (SRML), where agent goals are represented as Linear Temporal Logic (LTL) formulae, together with a claim about the equilibrium behaviour of the system, also expressed as an LTL formula. EVE can then check whether the LTL claim holds on some (or every) computation of the system that could arise through agents choosing Nash equilibrium strategies; it can also check whether a system has a Nash equilibrium, and synthesise individual strategies for players in the multi-player game. After presenting our basic framework, we describe our new technique and prove its correctness. We then describe our implementation in the EVE system, and present experimental results which show that EVE performs favourably in comparison to other existing tools that support rational verification.
... Goranko and van Drimmelen [17] gave a complete axiomatization of ATL. Decidability and model checking problems for ATLlike systems have also been studied [18,19,20]. Alternative approaches to expressing the power to achieve a goal in a temporal setting are the STIT logic [21,22,23,24,25] and Strategy Logic [26,27,19,28]. ...
Article
Full-text available
The article compares two different approaches of incorporating probability into coalition logics. One is based on the semantics of games with stochastic transitions, and the other on games with the stochastic failures. The work gives an example of a non-trivial property of coalition power for the first approach and a complete axiomatization for the second approach. It turns out that the logical properties of the coalition power modality under the second approach depend on whether the modal language allows the empty coalition. The main technical results for the games with stochastic failures are a strong completeness theorem for the logical system without the empty coalition and an incompleteness theorem which shows that there is no strongly complete logical system in the language with the empty coalition.
... At the same time, [40] is missing knowledge modality and ability to refer to the past, which are present in our logic. Decidability and model checking problems for ATL-like systems has also been widely studied [7,12,13]. An alternative approach to expressing the power to achieve a goal in a temporal setting is the STIT logic [11,26,27,34,42]. ...
Article
Full-text available
The article proposes a trimodal logical system that can express the strategic ability of coalitions to learn from their experience. The main technical result is the completeness of the proposed system.
... However, as the expressive power of LDL F is incomparable with the one of LTL, it is not clear whether the undecidability proof (which strongly relies on the expressiveness of LTL) can be retained in this case. Moreover, it has been shown that for specific cases of imperfect information in games with LTL objectives, the problem might be decidable [4,5]. For this reason, we plan to address this question in future work. ...
Preprint
Linear Dynamic Logic on finite traces LDLf is a powerful logic for reasoning about the behaviour of concurrent and multi-agent systems. In this paper, we investigate techniques for both the characterisation and verification of equilibria in multi-player games with goals/objectives expressed using logics based on LDLf. This study builds upon a generalisation of Boolean games, a logic-based game model of multi-agent systems where players have goals succinctly represented in a logical way. Because LDLf goals are considered, in the settings we study -- Reactive Modules games and iterated Boolean games with goals over finite traces -- players' goals can be defined to be regular properties while achieved in a finite, but arbitrarily large, trace. In particular, using alternating automata, the paper investigates automata-theoretic approaches to the characterisation and verification of (pure strategy Nash) equilibria, shows that the set of Nash equilibria in multi-player games with LDLf objectives is regular, and provides complexity results for the associated automata constructions.
... Other approaches have been introduced to retain decidability when reasoning about strategies in MAS. A notable direction involves imposing a hierarchy on the information, or the observations, of the agents [33,34,35,36,37]. This constraints in a well-structured way the information that agents possess. ...
Article
Full-text available
Model checking multi-agent systems, in which agents are distributed and thus may have different observations of the world, against strategic behaviours is known to be a complex problem in a number of settings. There are traditionally two ways of ameliorating this complexity: imposing a hierarchy on the observations of the agents, or restricting agent actions so that they are observable by all agents. We study systems of the latter kind, since they are more suitable for modelling rational agents. In particular, we define multi-agent systems in which all actions are public and study the model checking problem of such systems against Strategy Logic with equality, a very rich strategic logic that can express relevant concepts such as Nash equilibria, Pareto optimality, and due to the novel addition of equality, also evolutionary stable strategies. The main result is that the corresponding model checking problem is decidable.
... Goranko and van Drimmelen [32] gave a complete axiomatization of ATL. Additionally, decidability and model checking problems for ATL-like systems has also been studied in recent works [8,13,14]. Another approach to express "power to achieve" in a temporal setting is STIT logic [11,33,35,36,45]. Broersen, Herzig, and Troquard have shown that coalition logic can be embedded into a variation of STIT logic with the temporal modality "next-step" [17]. ...
Preprint
A coalition of agents, or a single agent, has an ethical dilemma between several statements if each joint action of the coalition forces at least one specific statement among them to be true. For example, any action in the trolley dilemma forces one specific group of people to die. In many cases, agents face ethical dilemmas because they are restricted in the amount of the resources they are ready to sacrifice to overcome the dilemma. The paper presents a sound and complete modal logical system that describes properties of dilemmas for a given limit on a sacrifice.
Conference Paper
A major challenge for logics for strategies is represented by their verification in contexts of imperfect information. In this contribution we advance the state of the art by approximating the verification of Alternating-time Temporal Logic (ATL) under imperfect information by using perfect information and a three-valued semantics. In particular, we develop novel automata-theoretic techniques for the linear-time logic LTL, then apply these to finding “failure” states, where the ATL specification to be model checked is undefined. Such failure states can then be fed into a refinement procedure, thus providing a sound, albeit incomplete, verification procedure.
Article
In the context of multi-agent systems, the rational verification problem is concerned with checking which temporal logic properties will hold in a system when its constituent agents are assumed to behave rationally and strategically in pursuit of individual objectives. Typically, those objectives are expressed as temporal logic formulae which the relevant agent desires to see satisfied. Unfortunately, rational verification is computationally complex, and requires specialised techniques in order to obtain practically useable implementations. In this paper, we present such a technique. This technique relies on a reduction of the rational verification problem to the solution of a collection of parity games. Our approach has been implemented in the Equilibrium Verification Environment (EVE) system. The EVE system takes as input a model of a concurrent/multi-agent system represented using the Simple Reactive Modules Language (SRML), where agent goals are represented as Linear Temporal Logic () formulae, together with a claim about the equilibrium behaviour of the system, also expressed as an formula. EVE can then check whether the claim holds on some (or every) computation of the system that could arise through agents choosing Nash equilibrium strategies; it can also check whether a system has a Nash equilibrium, and synthesise individual strategies for players in the multi-player game. After presenting our basic framework, we describe our new technique and prove its correctness. We then describe our implementation in the EVE system, and present experimental results which show that EVE performs favourably in comparison to other existing tools that support rational verification.
Article
Linear Dynamic Logic on finite traces (LDLF) is a powerful logic for reasoning about the behaviour of concurrent and multi-agent systems. In this paper, we investigate techniques for both the characterisation and verification of equilibria in multi-player games with goals/objectives expressed using logics based on LDLF. This study builds upon a generalisation of Boolean games, a logic-based game model of multi-agent systems where players have goals succinctly represented in a logical way. Because LDLF goals are considered, in the settings we study—Reactive Modules games and iterated Boolean games with goals over finite traces—players' goals can be defined to be regular properties while achieved in a finite, but arbitrarily large, trace. In particular, using alternating automata, the paper investigates automata-theoretic approaches to the characterisation and verification of (pure strategy Nash) equilibria, shows that the set of Nash equilibria in multi-player games with LDLF objectives is regular, and provides complexity results for the associated automata constructions.
Article
Full-text available
Quantified CTL (QCTL) is a well-studied temporal logic that extends CTL with quantification over atomic propositions. It has recently come to the fore as a powerful intermediary framework to study logics for strategic reasoning. We extend it to include imperfect information by parameterizing quantifiers with an observation that defines how well they observe the model, thus constraining their behaviour. We consider two different semantics, one related to the notion of no memory, the other to perfect recall. We study the expressiveness of our logic, and show that it coincides with MSO for the first semantics and with MSO with equal level for the second one. We establish that the model-checking problem is Pspace-complete for the first semantics. While it is undecidable for the second one, we identify a syntactic fragment, defined by a notion of hierarchical formula, which we prove to be decidable thanks to an automata-theoretic approach.
Article
Temporal logic comes in two varieties: linear-time temporal logic assumes implicit universal quantification over all paths that are generated by system moves; branching-time temporal logic allows explicit existential and universal quantification over all paths. We introduce a third, more general variety of temporal logic: alternating-time temporal logic offers selective quantification over those paths that are possible outcomes of games, such as the game in which the system and the environment alternate moves. While linear-time and branching-time logics are natural specification languages for closed systems, alternative-time logics are natural specification languages for open systems. For example, by preceding the temporal operator "eventually" with a selective path quantifier, we can specify that in the game between the system and the environment, the system has a strategy to reach a certain state. Also, the problems of receptiveness, realizability, and controllability can be formulated as model-checking problems for alternating-time formulas. Depending on whether we admit arbitrary nesting of selective path quantifiers and temporal operators, we obtain the two alternating-time temporal logics ATL and ATL*. We interpret the formulas of ATL and ATL* over alternating transition systems. While in ordinary transitory systems, each transition corresponds to a possible step of the system, in alternating transition systems, each transition corresponds to a possible move in the game between the system and the environment. Fair alternating transition systems can capture both synchronous and asynchronous compositions f open systems. For synchronous systems, the expressive power of ATL beyond CTL comes at no cost: the model-checking complexity of synchronous ATL is linear in the size of the system and the length of the formula. The symbolic model-checking algorithm for CTL extends with few modifications to synchronous ATL, and with some work, also to asynchronous to ATL, whose model-checking complexity is quadratic. This makes ATL an obvious candidate for the automatic verification of open systems. In the case of ATL*, the model-checking problem is closely related to the synthesis problem for linear-time formulas, and requires doubly exponential time for both synchronous and asynchronous systems.
Conference Paper
Systems within the agent-oriented paradigm range from ones where a single agent is coupled with an environment to ones inhabited by a large number of autonomous entities. In this paper, we look at what distinguishes single-agent systems from multi-agent systems. We claim that multi-agency implies limited coordination, in terms of action and/or information. If a team is characterized by full coordination both on the level of action choice and the available information, then we may as well see the team as a single agent in disguise. To back the claim formally, we consider a variant of Alternating-time Temporal Logic atl where each coalition operates with a single indistinguishability relation. For this variant, we propose a truth-preserving translation of formulas and models in the syntactic fragment of atl where only singleton coalitions are allowed. In consequence, we show that assuming unified view of the world on part of each coalition reduces the full language of atl to its single-agent fragment when a model is given.
Article
We study the extension of the alternating-time temporal logic (ATL) with strategy contexts: contrary to the original semantics, in this semantics the strategy quantifiers do not reset the previously selected strategies.We show that our extension ATLsc is very expressive, but that its decision problems are quite hard: model checking is k-EXPTIME-complete when the formula has k nested strategy quantifiers; satisfiability is undecidable, but we prove that it is decidable when restricting to turn-based games. Our algorithms are obtained through a very convenient translation to QCTL (the computation-tree logic CTL extended with atomic quantification), which we show also applies to Strategy Logic, as well as when strategy quantification ranges over memoryless strategies.
Article
Alternating-time temporal logic with strategy contexts (ATLsc) is a powerful formalism for expressing properties of multi-agent systems: it extends CTL with strategy quantifiers, offering a convenient way of expressing both collaboration and antagonism between several agents. Incomplete observation of the state space is a desirable feature in such a framework, but it quickly leads to undecidable verification problems. In this paper, we prove that uniform incomplete observation (where all players have the same observation) preserves decidability of the model-checking problem, even for very expressive logics such as ATLsc.
Article
Infinite games with imperfect information tend to be undecidable unless the information flow is severely restricted. One fundamental decidable case occurs when there is a total ordering among players, such that each player has access to all the information that the following ones receive. In this paper we consider variations of this hierarchy principle for synchronous games with perfect recall, and identify new decidable classes for which the distributed synthesis problem is solvable with finite-state strategies. In particular, we show that decidability is maintained when the information hierarchy may change along the play, or when transient phases without hierarchical information are allowed.
Article
While it was defined long ago, the extension of CTL with quantification over atomic propositions has never been studied extensively. Considering two different semantics (depending whether propositional quantification refers to the Kripke structure or to its unwinding tree), we study its expressiveness (showing in particular that QCTL coincides with Monadic Second-Order Logic for both semantics) and characterise the complexity of its model-checking and satisfiability problems, depending on the number of nested propositional quantifiers (showing that the structure semantics populates the polynomial hierarchy while the tree semantics populates the exponential hierarchy).
Article
Alternating-time temporal logic (ATL) is a modal logic that allows to reason about agents’ abilities in game-like scenarios. Semantic variants of ATL are usually built upon different assumptions about the kind of game that is played, including capabilities of agents (perfect vs. imperfect information, perfect vs. imperfect memory, etc.). ATL has been studied extensively in previous years; however, most of the research focused on model checking. Studies of other decision problems (e.g., satisfiability) and formal meta-properties of the logic (like axiomatization or expressivity) have been relatively scarce, and mostly limited to the basic variant of ATL where agents possess perfect information and perfect memory. In particular, a comparison between different semantic variants of the logic is largely left untouched. In this paper, we show that different semantics of ability in ATL give rise to different validity sets. The issue is important for several reasons. First, many logicians identify a logic with its set of true sentences. As a consequence, we prove that different notions of ability induce different strategic logics. Secondly, we show that different concepts of ability induce different general properties of games. Thirdly, the study can be seen as the first systematic step towards satisfiability-checking algorithms for ATL with imperfect information. We introduce sophisticated unfoldings of models and prove invariance results that are an important technical contribution to formal analysis of strategic logics.
Article
Extending the complexity results of Reif [1,2] for two player games of incomplete information, this paper (see also [3]) presents algorithms for deciding the outcome for various classes of multiplayer games of incomplete information, i.e., deciding whether or not a team has a winning strategy for a particular game. Our companion paper, [4] shows that these algorithms are indeed asymptotically optimal by providing matching lower bounds. The classes of games to which our algorithms are applicable include games which were not previously known to be decidable. We apply our algorithms to provide alternative upper bounds, and new time-space trade-offs on the complexity of multiperson alternating Turing machines [3]. We analyze the algorithms to characterize the space complexity of multiplayer games in terms of the complexity of deterministic computation on Turing machines.In hierarchical multiplayer games, each additional clique (subset of players with the same information) increases the complexity of the outcome problem by a further exponential. We show that an S(n) space bounded k-player game of incomplete information has a deterministic time upper bound of k + 1 repeated exponentials of S(n). Furthermore, S(n) space bounded k-player blindfold games have a deterministic space upper bound of k repeated exponentials of S(n). This paper proves that this exponential blow-up can occur.We also show that time bounded games do not exhibit such hierarchy. A T(n) time bounded blindfold multiplayer game, as well as a T(n) time bounded multiplayer game of incomplete information, has a deterministic space bound of T(n).